What’s the order of message processors in your Graylog cluster?
Check it on the System / Configurations page.